[krbdev.mit.edu #8479] git commit
"Greg Hudson via RT" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.bugs |
|---|---|
| Message-ID | <[email protected]> |
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8479 > S4U2Proxy evidence tickets needn't be forwardable With the introduction of resource-based constrained delegation, the absence of the forwardable flag no longer implies that a ticket cannot be used for constrained delegation requests. Instead, we should check in the PAC to see if the user is marked as sensitive, and error out in that case rather than making a failed request. But we don't always have access to the PAC and we currently do not have the code to retrieve this attribute from the PAC. Since krb5_get_credentials_for_proxy() no longer needs to look at the decrypted ticket, change kvno to not require a keytab for constrained delegation. [[email protected]: made minor style changes and commit message edits; updated documentation] https://github.com/krb5/krb5/commit/e131d339b81a22bfc91ab96990c3be9e7779200e Author: Isaac Boukris <[email protected]> Committer: Greg Hudson <[email protected]> Commit: e131d339b81a22bfc91ab96990c3be9e7779200e Branch: master doc/appdev/gssapi.rst | 35 ++++++++++--------------- src/clients/kvno/kvno.c | 40 ++++++++++++++--------------- src/lib/gssapi/krb5/accept_sec_context.c | 3 +- src/lib/gssapi/krb5/init_sec_context.c | 1 - src/lib/gssapi/krb5/s4u_gss_glue.c | 14 ++-------- src/lib/krb5/krb/s4u_creds.c | 16 +++-------- src/tests/gssapi/t_s4u.py | 25 ++++++++---------- 7 files changed, 53 insertions(+), 81 deletions(-)